CVE-2019-15017 : The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier,

The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this can allow an attacker to authenticate to the service using hardcoded credentials.

Published 2019-10-09 21:15:13

Updated 2023-02-04 00:22:02

Source Palo Alto Networks, Inc.

View at NVD, CVE.org

Products affected by CVE-2019-15017

Zingbox » Inspector
Versions up to, including, (<=) 1.294
cpe:2.3:a:zingbox:inspector:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-15017

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15017

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-15017

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-15017

https://security.paloaltonetworks.com/CVE-2019-15017

CVE-2019-15017 SSH Service Exposed in Zingbox Inspector
Third Party Advisory

Jump to

Vulnerability Details : CVE-2019-15017

Products affected by CVE-2019-15017

Exploit prediction scoring system (EPSS) score for CVE-2019-15017

CVSS scores for CVE-2019-15017

CWE ids for CVE-2019-15017

References for CVE-2019-15017